Procedure examples

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.

COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.

The first stage of COATHANGER is delivered as a packed file.

COATHANGER includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.

COATHANGER will query running process information to determine subsequent program execution flow.

COATHANGER provides a BusyBox reverse shell for command and control.

COATHANGER removes files from victim environments following use in multiple instances.

COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.

COATHANGER will survey the contents of system files during installation.

COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.

COATHANGER decodes configuration items from a bundled file for command and control activity.

COATHANGER is installed following exploitation of a vulnerable FortiGate device.

COATHANGER will set the GID of `httpsd` to 90 when infected.

COATHANGER will create a daemon for timed check-ins with command and control infrastructure.

COATHANGER creates and installs itself to a hidden installation directory.

COATHANGER connects to command and control infrastructure using SSL.

COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as `read(2)`.

COATHANGER copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1. This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.